Gitea does not re-check the 'official' flag on existing pull request reviews when the PR's target branch is changed. The 'official' flag, which indicates if a reviewer's approval counts towards branch protection, is computed at review submission based on the target branch's approval whitelist and stored in the database. When the PR target branch changes, existing reviews are not updated or dismissed. At merge time, Gitea counts stored 'official=true' approvals without revalidating against the new branch's whitelist. An attacker with write access can exploit this by obtaining an official approval on a PR targeting an unprotected branch and then retargeting the PR to a protected branch, allowing merge without authorized approval.

An attacker with write access to a repository can bypass branch protection rules requiring approvals from designated reviewers. This enables merging code into protected branches without legitimate maintainer approval, potentially introducing unauthorized or malicious changes. The vulnerability does not require admin access or membership in the protected branch's approval whitelist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to trusted users only and monitor pull request target branch changes closely. Consider manual review of PR retargeting events to ensure approvals remain valid.